Preamble

When processing personal data, Glósz és Társa Kft. (hereinafter ‘Controller’) as a controller acts in accordance with the provisions and the relevant laws of Regulation (EU) 2016/679 of the European Parliament and of the Council (27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Glósz és Társa Kft. respects your (hereinafter ‘Data Subject’) rights concerning the protection of personal data. This policy gives a concise and simple summary about what type of data we collect, how we may use them, and it describes the means used by us and the Data Subjects’ options for data protection and for enforcement.

The details can be found in the mentioned Regulation, should you need further information, please refer to the Regulation.

Definitions

• Personal data – means any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• Processing – means any operation or set of operations performed on personal data or data records, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• Controller – means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law;
• Processor – means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
• Recipient – means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients;
• Third party – means a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor and persons who, under the direct authority of the Controller or Processor, are authorised to process personal data;
• Consent of the Data Subject – means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them;
• Profiling – means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
• Personal data breach – means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
• Authority: Hungarian National Authority for Data Protection and Freedom of Information naih.hu

1. Name and contact details of the Controller (Service provider)

Name of the Controller: Glósz és Társa Kft.

Registered office: 1051 Budapest, Arany János utca 15. 3. em. 5.

Postal address: 1372 Budapest, Pf.: 484.

Company registration number: 01 09 469866

Customer Service e-mail address: adatvedelem@glosz.hu

Place and contact details for handling complaints: 1051 Budapest, Arany János utca 15. 3. em. 5.

2. Purposes of data processing, type of processed data, duration of data processing, persons with right of access to personal data

Purposes of data processing

Personal data shall be processed only for specific purposes, to the extent to which it is necessary, in order to exercise a right or to comply with an obligation. The data processing shall comply with the purpose of data processing all the time, data recording and processing should be fair and lawful. Personal data shall be processed to the extent and period necessary for fulfilling the purposes. The Controller made regulations in internal instructions that data shall be processed only by recipients necessarily co-operating in the fulfilment of data processing purposes.

The Controller has a legitimate interest in processing personal data in the following cases

• Fulfilling a contracted service
• Providing IT background to ensure a service

Types of processed data, duration of data processing, persons with right to access personal data

According to the previous information, with reference to the specified legal basis, we collect the following types of data and process them for the determined retention period.

DATA PROCESSED ON THE BASIS OF LEGITIMATE INTEREST

Description of data	Retention time
Name	The retention time is 5 years according to the cessation of the legitimate interest or according to the legal requirement relevant to it (Civil Code 6:22§)
E-mail address
Telephone number
Company position

3. Collecting, using and transferring personal data

The Controller observes the relevant legal requirements, restrictions and ethical standards when collecting personal data.

The Controller

• informs Data Subjects on Controller’s data processing practice in the required way, in time, before starting the data processing.
• collects, retains and uses personal data only for determined purposes. The information collected is always suitable, relevant, and appropriate in extent to the specified purpose.
• takes measures that are reasonable for achieving the specified purpose, so that the Data Subjects’ personal data is complete, accurate, up to date and reliable to the extent suitable for the purpose.
• uses your personal data for promotion only with your consent and provides the opportunity to prohibit such communication.
• Takes reasonable and careful measures in order to ensure the protection of the Data Subjects’ personal data, including cases, when the Controller transfers data to a third party. Data transfer to a third party shall not take place without the prior, explicit consent of the Data Subject.

The Controller contracts the below Processor to handle personal data for the specified activities

Processor	Company registration number/VAT number	Contracted activities
TomSoft Informatika/Tamás Fehérvári individual entrepreneur	62555636-2-27	Providing IT background to ensure company operation

4. Access to and amendment, rectification, erasure, and portability of personal data

Access

The Data Subject has the right to receive feedback from the Controller about whether his or her personal data is currently being processed, and if it is, they have the right to access the personal data and the following information:

1. purposes of data processing;
2. types of personal data concerned;
3. recipients or the categories of recipients who have received or will receive the personal data.

Amendment, rectification

The Data Subject has right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Portability

The Data Subject has the right to receive their personal data, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format and to transmit those data to another Controller without hindrance from

the Controller to which the personal data has been provided, where:

1. the data processing is based on the freely given consent of the Data Subject or on a contract where the Data Subject is one of the parties; and
2. the processing of personal data is carried out by automated means.
3. Erasure, restriction of personal data, the right to object
   Erasure

• The Data Subject has the right to obtain from the Controller the erasure of their personal data without undue delay and the Controller is obliged to erase personal data concerning the Data Subject without undue delay where one of the following grounds applies:
  1. the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  2. the Data Subject withdraws consent on which the processing is based via the contact details provided by the Controller, and where there is no other legal ground for the processing;
  3. the Data Subject objects to the data processing on grounds relating to his or her particular situation or because of data processing for direct marketing and there are no overriding legitimate grounds for the processing;
  4. the personal data has been unlawfully processed;
  5. the personal data has to be erased in order to comply with a legal obligation in Union or Member State law to which the Controller is subject;
  6. the personal data has been collected in relation to an offer of an information society service directed at children.
• Where the Controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the Controller, taking into account the available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform Controllers which are processing the personal data that the Data Subject has requested the erasure by such Controllers of any links to, or copy or replication of, such personal data.
• Paragraphs 1 and 2 shall not apply to the extent that the processing is necessary:
  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;

1. for reasons of occupational medicine or of public interest in the area of public health;
2. for archiving purposes in the public interest, scientific and historical research purposes or statistical purposes in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
3. for the establishment, exercise or defence of legal claims.

Restriction

• The Data Subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:
  1. the accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data;
  2. the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
  3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims; or
  4. the Data Subject has objected to the processing on grounds relating to his or her particular situation, pending the verification of whether the legitimate grounds of the Controller override those of the Data Subject.
• Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the Data Subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
• A Data Subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the Controller before the restriction of processing is lifted.

Right to object

The Data Subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of their personal data, if the data processing is carried out exercising official authority vested in the Controller or if the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, including profiling based on the mentioned provisions. In such cases, the Controller shall no longer control the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, the Data Subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the Data Subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

6. Enforcement options of user rights

When the User’s personal rights are infringed, as well as in cases determined in the Regulation you can request help from the Hungarian National Authority for Data Protection and Freedom of Information:

Name: Hungarian National Authority for Data Protection and Freedom of Information
1530 Budapest, Pf.: 5.
Address: 1125 Budapest, Szilágyi Erzsébet fasor 22/c.
Telephone: +36 (1) 391-1400
Fax: +36 (1) 391-1410
Website: naih.hu
Email: ugyfelszolgalat@naih.hu

7. Amendments to the Privacy Policy

The Controller reserves the right to amend or update this “Privacy Policy” at any time without prior information and disclose the updated version on its websites. Any amendment applies solely to the data collected after the disclosure of the updated version.

Please, check our Privacy Policy regularly so as to keep up with the changes, and make sure to obtain information on how the changes affect you.

Last update: 22/May/2018